C1 is a capable product, and the reasons to leave it are not that it stopped working. Workday is buying it, homegrown apps often run on connectors your own engineers have to maintain, and the apps C1 can't reach still end up as tickets. This guide is for a team that has decided to look at Iden: how to prove it without risk, what moves, how C1's concepts map, and how to make the case inside your company.
Why teams switch from C1
There are three reasons to move, and they often arrive together.
The connectors for your internal apps are yours to maintain. If your engineers built them on C1's Baton SDK, every change to those apps, or to Baton, falls to the same engineers. Iden builds and maintains custom connectors itself, so internal apps become zero-touch on your side.
The apps C1 can't provision still become tickets. C1's docs say a custom connector needs an app whose API can list users, and apps without one go through file sync and Jira tickets. Iden has connectors for 220+ apps without SCIM and automates the admin console of apps with no API, so those apps get provisioned and deprovisioned rather than queued.
The roadmap now belongs to Workday. Workday signed to buy C1 on October 12, 2026, and expects to close by January 31, 2027. Neither company has said what happens to pricing, hosting or HR systems other than Workday. The C1 alternatives guide covers what's known and what to ask C1 before you renew.
Prove it with a pilot, run alongside C1, and leave your contract early
Start with a 2-week trial on the apps that hurt most in C1 today: the ones that end up as tickets, plus one internal app with a Baton connector. Iden connects the first 15 apps in under an hour, on your own data.
C1 keeps provisioning the whole time. Iden runs alongside it until you have seen one full review cycle of its decisions, so nothing about your controls changes until you choose the cutover.
When you decide to move, Iden covers the rest of your C1 contract and runs the migration at no charge. Your renewal date stops deciding your timeline.
What staying on C1 costs against switching
Move the sliders to your own numbers. The C1 side counts the licence, the engineer hours that keep your Baton connectors working, and the IT time on access tickets C1 can't automate. Iden builds the connectors and provisions those apps, so neither cost carries over.
What moves, and how
Every app in your C1 environment takes one of three routes into Iden.
- Apps with SCIM or a public API are reconnected. Iden's connector library covers them, with no plan upgrade needed for SCIM.
- Internal apps with a Baton connector are rebuilt by Iden from your API documentation: a Postman collection, an OpenAPI spec or plain docs. Rebuilt connectors are ready within 12 hours, and Iden maintains them afterwards.
- Apps C1 sent to Jira tickets are automated through the app's admin console. A person gets a task only where an app needs one, and the task records how the access was closed.
Mapping C1 to Iden
| C1 | Iden | What changes |
|---|---|---|
| Baton connectors your engineers built | Custom connectors Iden builds and maintains | Rebuilt from your API docs within 12 hours. No connector code on your side |
| Out-of-the-box connectors | Iden connectors over SCIM, API or the admin console | 220+ apps without SCIM included at no extra cost |
| File sync and Jira tickets for apps with no API | Admin-console automation | The access is provisioned and removed, not queued |
| Birthright access profiles | Role policies and access templates | Unexplained profiles are dropped, not copied |
| Onboarding, offboarding and transfer automations | Joiner, mover and leaver lifecycle from the HR record | Contractor end dates enforced as leaver dates |
| Request policies and max request duration | Access requests in Slack or Teams, with expiring grants | Approvers see what a role can do before they approve |
| Access review campaigns | Access reviews | One decision per row, with the revocation recorded against it |
| Campaign reports with file hashes | Exported before cutover, then Iden's audit log | Every action exportable at any time |
| Access conflicts | Separation-of-duties checks at request time | Conflicts flagged before access is granted |
| Identities dashboard for service accounts and agents | Non-human identity governance | Each identity gets an owner, a scope and an expiry |
Before you start
Gather these before the first call. None of them needs anyone outside IT.
- Your C1 renewal date and notice period, so the contract cover can be lined up.
- Every Baton connector you run, who maintains it, and where its API documentation lives.
- The apps C1 sends to Jira tickets today, and how many tickets they create a month.
- Your HR system, and which events start onboarding, transfers and offboarding.
- Any access review campaign in flight, and when your auditors' next period starts.
- The C1 approval policies people complain about. These are the first to rewrite rather than copy.
The migration plan
The connectors take days. The calendar is set by your review cycle, because the parallel run lasts one cycle.
- Export your evidence from C1. Pull the access review reports with their file hashes and the request history. Your auditor will ask for the last period whatever you run next.
- Hand over your Baton connectors. Send the API documentation for each internal app. Iden rebuilds every connector within 12 hours.
- Connect your HR system and apps. The HR system becomes the source of joiner, mover and leaver events. The first 15 apps connect in under an hour, and the rest follow over a few days.
- Map your policies. C1's birthright profiles become role policies, and its request policies become approval routes and expiry rules. Any profile nobody can explain is one to drop.
- Run alongside C1 for one review cycle. C1 still provisions. Compare who each would have granted and removed, and check that the apps C1 left as tickets are now closed by Iden.
- Cut over at a review boundary. Switch the HR trigger to Iden between campaigns, so no review is split across two tools and two evidence trails.
- Sunset C1. Keep it read-only for a cycle with the exports filed, then switch it off. Iden covers the rest of the contract.
If anything looks wrong during the parallel run, C1 is still provisioning, so stopping costs nothing.
Announce the change
App owners and approvers notice a switch more than employees do. Send something like this a week before the parallel run starts, and edit it to fit.
Subject: We're moving access requests and reviews from C1 to Iden
From [date], access requests and access reviews move from C1 to Iden. You'll still request access in [Slack or Teams]; the approval message will look different.
If you own an app, you'll see one change: requests for [apps] that used to arrive as Jira tickets will be handled automatically.
Our next access review, starting [date], runs in Iden. Reviews work the same way: one decision per person per role.
Questions go to [name or channel].
Making the case internally
Expect three objections. Each has a short answer.
"C1 works fine for us"
For the apps it reaches, it may. The cost is in the apps it doesn't: the Baton connectors your engineers maintain and the tickets for apps with no API. Add up the engineering hours and the tickets for one quarter, then compare it with a per-user price where every connector is included.
"Switching now is too disruptive"
Nothing changes for employees until the cutover, and nothing changes for auditors until a review boundary. C1 keeps running through the parallel cycle. The disruptive version of this move is the one forced on you later by a price list you haven't seen yet.
"We've invested too much in our Baton connectors"
The investment worth keeping is your team's knowledge of how those apps work, and that carries over in the API docs you send. The code doesn't need to. Iden rebuilds the connectors within 12 hours and maintains them, which ends the work rather than moving it.
Where to start
Book a 25-minute session with your C1 app list and your Baton connector list. You'll see which apps Iden governs end to end, how long the parallel run would take for your review calendar, and how the contract cover works for your renewal date.